What the website security scanner checks
The scanner looks at your site the way a browser, a search engine and an attacker doing reconnaissance would, using only public information. It never sends attack payloads, never guesses passwords and never looks for hidden files, so it is safe to run against any site.
| Area | Checks |
|---|---|
| Transport | HTTPS availability, HTTP→HTTPS redirect, TLS 1.3 support, legacy TLS 1.0/1.1 |
| Certificate | Trust chain, hostname match, expiry, key strength |
| Security headers | HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy |
| Cookies | Secure, HttpOnly and SameSite flags |
| Content | Mixed content, insecure forms, third-party scripts without Subresource Integrity |
| Information disclosure | Server, X-Powered-By and CMS version leaks |
| DNS & email | DNSSEC, CAA, SPF and DMARC |
| Reputation & policy | Server IP on spam blocklists, security.txt (RFC 9116) |
How the grade is calculated
Each site starts at 100 points. High-severity findings cost 20 points, medium 10 and low 4; informational notes cost nothing. A is 90+, B 80+, C 65+, D 50+ and anything lower is F. Fixing the high and medium items usually lifts a site to A or B within an afternoon.
Security scan vs penetration test
A penetration test is an authorised, simulated attack carried out by security professionals. Testers try to exploit vulnerabilities in your application, servers and processes: injection flaws, broken authentication, access-control mistakes, misconfigurations and more, typically following methodologies such as the OWASP Web Security Testing Guide and PTES. A pentest requires written permission from the system owner; testing systems you do not own is illegal in most countries.
This scanner is the first step of that process, an external configuration review. It catches the most common, easily fixed weaknesses that real attackers check first. For an application you are responsible for, combine it with:
- Regular dependency and CMS updates, plus automated dependency scanning.
- An authenticated application scan of a test environment with an open-source tool such as OWASP ZAP.
- A professional penetration test before major launches and at least yearly for sites handling personal or payment data.
- A vulnerability disclosure policy (security.txt) so researchers can report issues to you.
Quick wins
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'; upgrade-insecure-requests
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Set-Cookie: session=…; Secure; HttpOnly; SameSite=LaxDig deeper with the SSL checker, HTTP headers checker, DNSSEC checker and SPF & DMARC checker, and read what an SSL certificate does.
Frequently asked questions
Is it legal to scan any website with this tool?
Yes. The scanner only reads public information that every visitor's browser receives, at normal browsing volume. It does not attempt to break in.
Why does my site get a low grade when it has never been hacked?
The grade reflects defence in depth. Missing headers and old TLS versions are not vulnerabilities on their own, but they make successful attacks easier and are flagged by compliance audits such as PCI DSS.
How do I download the report?
Click Download PDF report and choose "Save as PDF" in the print dialog. The report URL can also be shared with your developer.